You should check one of the permissions from Orchard.Framework. I'd say probably site owner. You could either check it from the template or add a specific property on the shape that the template code can look at to decide what to display. If it's the whole
part that shouldn't be displayed, the easiest is probably to do it from the driver and just return a new empty ShapeResult when permissions don't match.